Malware Forensics practice questions

During a malware investigation, an analyst discovers a suspicious file with a hash value that matches known malware. However, the file fails to execute and does not exhibit any malicious behavior in a sandbox. What is the most likely reason for this discrepancy?

Trap 1: The file is a false positive and is actually benign

A false positive would imply the hash does not match known malware; here it does match.

Trap 2: The sandbox is not updated with the latest signatures

Hash matching is independent of signatures; the sandbox would still see the file as malicious based on hash.

Trap 3: The file's metadata has been modified to evade analysis

Modifying metadata would change the file hash, so the hash would not match known malware.

A
The file is a false positive and is actually benign
Why wrong: A false positive would imply the hash does not match known malware; here it does match.
B
The sandbox is not updated with the latest signatures
Why wrong: Hash matching is independent of signatures; the sandbox would still see the file as malicious based on hash.
C
The file's metadata has been modified to evade analysis
Why wrong: Modifying metadata would change the file hash, so the hash would not match known malware.
D
The file is packed or obfuscated to prevent execution in a sandbox
Packing can prevent execution until unpacked, causing the sandbox to not observe malicious behavior.

Question 2hardmultiple choice

An organization suspects a stealthy malware infection on a critical server. Traditional antivirus and EDR solutions have not detected anything. Which forensic approach would be most effective in identifying the malware, given that it likely resides only in memory?

Trap 1: Perform a full disk scan with updated antivirus signatures

Fileless malware does not write to disk, so disk scans would not detect it.

Trap 2: Conduct a live analysis using built-in Windows tools like Task…

Live analysis may miss stealthy malware and could alter forensic evidence.

Trap 3: Analyze network traffic for anomalies using a NetFlow analyzer

Network analysis may reveal C2 communications but not the malware code itself.

A
Perform a full disk scan with updated antivirus signatures
Why wrong: Fileless malware does not write to disk, so disk scans would not detect it.
B
Acquire a memory dump and perform memory forensics with tools like Volatility
Memory forensics captures the malware's code and artifacts in RAM for analysis.
C
Conduct a live analysis using built-in Windows tools like Task Manager
Why wrong: Live analysis may miss stealthy malware and could alter forensic evidence.
D
Analyze network traffic for anomalies using a NetFlow analyzer
Why wrong: Network analysis may reveal C2 communications but not the malware code itself.

Question 3easymultiple choice

A security analyst is tasked with reverse engineering a suspected malware sample. Which initial step should the analyst take to ensure safe handling and prevent accidental infection?

Trap 1: Execute the sample in a debugger on a production machine

Running on a production machine poses infection risk; use isolated lab.

Trap 2: Disassemble the binary using IDA Pro directly

Working directly on the original could alter it; always use a copy.

Trap 3: Connect the sample to an isolated network to observe behavior

This should be done after securing a copy; connecting first risks infection.

A
Create a bit-for-bit forensic image of the sample
A forensic copy preserves evidence and allows safe analysis.
B
Execute the sample in a debugger on a production machine
Why wrong: Running on a production machine poses infection risk; use isolated lab.
C
Disassemble the binary using IDA Pro directly
Why wrong: Working directly on the original could alter it; always use a copy.
D
Connect the sample to an isolated network to observe behavior
Why wrong: This should be done after securing a copy; connecting first risks infection.

Question 4mediummultiple choice

During malware analysis, an investigator finds that a suspicious process is injecting code into a legitimate system process (e.g., explorer.exe). Which technique is being used?

Trap 1: API hooking

API hooking intercepts calls but does not necessarily involve injecting code.

Trap 2: Process hollowing

Process hollowing replaces a legitimate process's memory with malicious code, not injection into a running process.

Trap 3: DLL injection

DLL injection is a form of code injection but more specific; the stem does not specify DLL.

A
API hooking
Why wrong: API hooking intercepts calls but does not necessarily involve injecting code.
B
Process hollowing
Why wrong: Process hollowing replaces a legitimate process's memory with malicious code, not injection into a running process.
C
Code injection
Code injection is the technique of inserting code into a running process.
D
DLL injection
Why wrong: DLL injection is a form of code injection but more specific; the stem does not specify DLL.

Question 5hardmulti select

Which TWO of the following are common indicators of a rootkit infection on a Windows system?

Trap 1: High CPU usage by svchost.exe

High CPU can be due to many reasons, not exclusively rootkits.

Trap 2: Unexpected open ports on the firewall

Open ports indicate network activity but not specifically rootkits.

Trap 3: Presence of unsigned kernel drivers

Unsigned drivers are a vulnerability but not a direct indicator of infection.

A
High CPU usage by svchost.exe
Why wrong: High CPU can be due to many reasons, not exclusively rootkits.
B
System calls returning inconsistent results
Rootkits hook system calls to return false information.
C
Unexpected open ports on the firewall
Why wrong: Open ports indicate network activity but not specifically rootkits.
D
Presence of unsigned kernel drivers
Why wrong: Unsigned drivers are a vulnerability but not a direct indicator of infection.
E
Hidden processes not visible in Task Manager
Rootkits hide processes from standard system tools.

Question 6mediummulti select

Which THREE of the following are best practices for conducting malware forensics in a safe and effective manner?

Trap 1: Delete the malware sample after analysis to prevent accidental…

Samples should be preserved for evidence and further analysis.

Trap 2: Run all analysis using the same tools and versions as the attacker

This could compromise the analysis and is not a best practice.

A
Use a dedicated forensic workstation that is not connected to any network
Prevents malware from spreading and ensures analysis integrity.
B
Delete the malware sample after analysis to prevent accidental infection
Why wrong: Samples should be preserved for evidence and further analysis.
C
Always create a cryptographic hash of the malware sample before analysis
Hashing verifies integrity and aids in identifying known samples.
D
Use a virtual machine or sandbox for dynamic analysis
Isolates the malware to prevent damage to the host system.
E
Run all analysis using the same tools and versions as the attacker
Why wrong: This could compromise the analysis and is not a best practice.

Question 7hardmultiple choice

Refer to the exhibit. An investigator is examining a disk image using TSK. The output from 'fls' shows the directory structure. What is the significance of the entry 'V/V 113-128-1: $OrphanFiles'?

Exhibit

Refer to the exhibit.

C:\> fls -f ntfs -o 2048 image.dd
r/r 4-128-3: $AttrDef
r/r 8-128-2: $BadClus
r/r 6-128-2: $Bitmap
r/r 7-128-1: $Boot
r/r 11-128-3: $Extend
r/r 2-128-1: $LogFile
r/r 0-128-1: $MFT
r/r 1-128-1: $MFTMirr
r/r 9-128-8: $Secure
r/r 10-128-1: $UpCase
r/r 3-128-3: $Volume
r/r 108-128-2: Users
r/r 109-128-3: ProgramData
r/r 110-128-2: Windows
r/r 111-128-1: Program Files
r/r 112-128-1: Program Files (x86)
V/V 113-128-1: $OrphanFiles
r/r 114-128-3: autoexec.bat
r/r 115-128-1: config.sys

Trap 1: It is a sign that a rootkit has hidden files in the image

$OrphanFiles is a normal artifact of file system analysis, not a rootkit indicator.

Trap 2: It indicates the location of the Master File Table (MFT) mirror

MFT mirror is $MFTMirr, not $OrphanFiles.

Trap 3: It is a standard NTFS metadata file that stores file permissions

$OrphanFiles is not a standard NTFS metadata file.

A
It is a sign that a rootkit has hidden files in the image
Why wrong: $OrphanFiles is a normal artifact of file system analysis, not a rootkit indicator.
B
It indicates the location of the Master File Table (MFT) mirror
Why wrong: MFT mirror is $MFTMirr, not $OrphanFiles.
C
It is a virtual directory that contains files with no parent directory, often from deleted files
'V/V' denotes a virtual directory for files that are not linked in the directory tree.
D
It is a standard NTFS metadata file that stores file permissions
Why wrong: $OrphanFiles is not a standard NTFS metadata file.

Question 8mediummultiple choice

You are a forensic analyst investigating a suspected malware infection on a Windows 10 workstation. The user reports that the system has been slow and that unexpected pop-ups appear. You have acquired a memory dump and a disk image. During analysis, you find a suspicious process named 'svch0st.exe' running with PID 4567. The process has loaded several DLLs, including 'wininet.dll' and 'ws2_32.dll'. You also find that the process has an active TCP connection to an external IP address 203.0.113.5 on port 4444. In the disk image, you find an executable file at C:\Users\Public\svch0st.exe with a creation date that matches the start of symptoms. The file's hash is not in any known malware database. You decide to perform dynamic analysis by running the file in a sandbox. However, the sandbox environment has no network connectivity. The executable runs but does not exhibit any malicious behavior. What should you do next to determine if the file is malicious?

Trap 1: Conduct a thorough static analysis using a disassembler and…

Static analysis is useful but may not reveal behavior that only triggers under specific conditions, such as network activity.

Trap 2: Delete the suspicious file and run a full antivirus scan on the…

Deleting evidence and relying solely on antivirus may miss advanced malware.

Trap 3: Perform a forensic imaging of the system again and compare with the…

Re-imaging does not help determine the file's behavior; dynamic analysis with network is needed.

A
Conduct a thorough static analysis using a disassembler and debugger to understand the code
Why wrong: Static analysis is useful but may not reveal behavior that only triggers under specific conditions, such as network activity.
B
Delete the suspicious file and run a full antivirus scan on the system
Why wrong: Deleting evidence and relying solely on antivirus may miss advanced malware.
C
Re-run the sample in a sandbox with simulated network connectivity or a controlled network to observe C2 communication
Network connectivity may be required for the malware to activate its malicious payload.
D
Perform a forensic imaging of the system again and compare with the original image
Why wrong: Re-imaging does not help determine the file's behavior; dynamic analysis with network is needed.

Question 9easymulti select

Which TWO techniques are commonly used to evade detection by antivirus software in packed malware?

Trap 1: Code obfuscation

Obfuscation makes code hard to read but is not a packing-specific evasion technique.

Trap 2: Anti-debugging tricks

Anti-debugging is a runtime evasion technique, not a packing evasion.

Trap 3: Anti-VM checks

Anti-VM checks detect sandboxes, not directly a packing technique.

A
Code obfuscation
Why wrong: Obfuscation makes code hard to read but is not a packing-specific evasion technique.
B
Anti-debugging tricks
Why wrong: Anti-debugging is a runtime evasion technique, not a packing evasion.
C
Polymorphic code
Polymorphic code mutates its signature, evading signature-based detection.
D
Anti-VM checks
Why wrong: Anti-VM checks detect sandboxes, not directly a packing technique.
E
Encryption with a variable key
Encryption hides the payload; variable keys prevent static analysis.

Question 10mediummultiple choice

Based on the exhibit, what is the most likely indication of malware persistence?

Exhibit

Refer to the exhibit.

C:\Users\Admin> sc query | findstr /i "service"
SERVICE_NAME: WinDefend
DISPLAY_NAME: Windows Defender Antivirus Service
STATE: 4 RUNNING

C:\Users\Admin> tasklist /svc
Image Name PID Services
================= ======== ============================================
svchost.exe 1234 WinDefend
svchost.exe 5678 BFE, MpsSvc
services.exe 4321 

C:\Users\Admin> netstat -ano | findstr :4444
  TCP    0.0.0.0:4444   0.0.0.0:0    LISTENING     4321

Trap 1: services.exe PID 4321 is a known malware process

services.exe is a legitimate system process; it's not inherently malware.

Trap 2: Windows Defender service is stopped, allowing malware to run

The exhibit shows Windows Defender is running (STATE: 4 RUNNING).

Trap 3: svchost.exe hosting BFE and MpsSvc indicates a firewall bypass

BFE (Base Filtering Engine) and MpsSvc (Windows Firewall) are normal services.

A
services.exe PID 4321 is a known malware process
Why wrong: services.exe is a legitimate system process; it's not inherently malware.
B
Windows Defender service is stopped, allowing malware to run
Why wrong: The exhibit shows Windows Defender is running (STATE: 4 RUNNING).
C
services.exe is listening on TCP port 4444, indicating possible code injection
services.exe should not have open listening ports; port 4444 is suspicious and suggests malware injected into the process.
D
svchost.exe hosting BFE and MpsSvc indicates a firewall bypass
Why wrong: BFE (Base Filtering Engine) and MpsSvc (Windows Firewall) are normal services.

Question 11hardmultiple choice

You are investigating a Windows 10 workstation that exhibits slow performance and frequent pop-ups. The user reports that the system started acting strangely after installing a 'PDF Converter' from an email attachment. You suspect malware. You have captured a memory dump using FTK Imager and a network capture during the infection. In the memory dump, you find a suspicious process 'conhost.exe' running from a non-standard location (C:\Users\Public\Temp). The process has an open handle to a file named 'config.ini' in the same directory. The network capture shows periodic HTTPS connections to 'malicious.com' on port 443 from the workstation's IP. Using Volatility, you extract the process's command line: 'conhost.exe -hidden -log C:\Users\Public\Temp\output.log'. Which of the following is the BEST immediate course of action to contain the threat and preserve evidence?

Trap 1: Delete the config.ini file and the conhost.exe executable…

Deleting files destroys evidence and the malware may recreate them if persistence is active.

Trap 2: Restore the system to a previous restore point.

System restore may not remove all malware artifacts and can overwrite critical evidence.

Trap 3: Terminate the suspicious conhost.exe process and run a full…

Terminating the process destroys volatile evidence and the malware may reinfect via persistence mechanisms.

A
Delete the config.ini file and the conhost.exe executable immediately.
Why wrong: Deleting files destroys evidence and the malware may recreate them if persistence is active.
B
Restore the system to a previous restore point.
Why wrong: System restore may not remove all malware artifacts and can overwrite critical evidence.
C
Terminate the suspicious conhost.exe process and run a full antivirus scan.
Why wrong: Terminating the process destroys volatile evidence and the malware may reinfect via persistence mechanisms.
D
Isolate the workstation from the network, then create a forensic image of the hard disk for analysis.
Isolation stops C2 communication and potential lateral movement; imaging preserves evidence for in-depth analysis.

Question 12mediummultiple choice

Refer to the exhibit. During a malware investigation, a forensic analyst runs the commands shown. What is the most likely conclusion?

Exhibit

Refer to the exhibit.

C:\> tasklist /svc
Image Name                     PID Services
========================= ======== ============================================
svchost.exe                   1236 CryptSvc, Dnscache, LmHosts, EventSystem
svchost.exe                   1344 W32Time, WdiServiceHost
svchost.exe                    768 BFE, MpsSvc
notepad.exe                   1456 N/A
svchost.exe                    524 SessionEnv, TermService, UmRdpService
rundll32.exe                  1500 N/A

C:\> netstat -ano | findstr :4444
  TCP    0.0.0.0:4444           0.0.0.0:0              LISTENING       1500

C:\> wmic process where processid=1500 get executablepath
ExecutablePath
C:\Windows\System32\rundll32.exe

Trap 1: Svchost.exe processes are hosting legitimate Windows services; no…

Svchost.exe hosting many services is normal, but the network connection on port 4444 is suspicious.

Trap 2: The malware has injected code into svchost.exe using a reflective…

No evidence of injection into svchost.exe; the suspicious process is rundll32.exe.

Trap 3: The malware is using port 4444 for Windows Update communications.

Windows Update does not use port 4444; it uses port 80/443.

A
Svchost.exe processes are hosting legitimate Windows services; no malware is present.
Why wrong: Svchost.exe hosting many services is normal, but the network connection on port 4444 is suspicious.
B
The malware has injected code into svchost.exe using a reflective DLL injection tool.
Why wrong: No evidence of injection into svchost.exe; the suspicious process is rundll32.exe.
C
The malware is using port 4444 for Windows Update communications.
Why wrong: Windows Update does not use port 4444; it uses port 80/443.
D
Rundll32.exe with PID 1500 is likely a backdoor listening on port 4444.
Rundll32.exe typically does not listen on network ports; PID 1500 is listening on a suspicious port, indicating malware.

Question 13hardmulti select

Which THREE of the following are indicators of malware persistence via registry run keys? (Choose three.)

Trap 1: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows…

This key stores scheduled tasks, not run key values.

Trap 2: HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services

This key stores service configurations, not run keys.

A
HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce
RunOnce keys execute programs once at next logon, used for persistence.
B
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tasks
Why wrong: This key stores scheduled tasks, not run key values.
C
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
This is a standard startup folder registry key used for persistence.
D
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services
Why wrong: This key stores service configurations, not run keys.
E
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx
RunOnceEx is an extended run key used for installation tasks but also abused by malware.

Question 14easymultiple choice

You are a forensic analyst investigating a Windows workstation that shows signs of malware infection. The user reports that the system is slow, network activity is high, and several files have been encrypted with a .encrypted extension. A ransom note named README.txt has been left on the desktop demanding payment. You have acquired a memory dump using FTK Imager and a disk image using dd. You need to identify the malware family and gather indicators of compromise (IOCs). Which of the following is the MOST appropriate first step?

Trap 1: Run the malware sample in a sandbox environment to observe its…

You haven't isolated the malware sample yet; first identify it from the ransom note.

Trap 2: Perform static analysis of the encrypted files to determine the…

Static analysis of encrypted files is difficult without the key; it's better to identify the malware first via other IOCs.

Trap 3: Immediately disconnect the system from the network and power it off…

While disconnecting is good, powering off may lose volatile data; you already have a memory dump, so this step is not first.

A
Extract the ransom note and search for known ransomware identifiers such as Bitcoin wallet addresses or contact email.
Ransom notes often contain unique identifiers that link to specific ransomware families, enabling quick identification.
B
Run the malware sample in a sandbox environment to observe its behavior.
Why wrong: You haven't isolated the malware sample yet; first identify it from the ransom note.
C
Perform static analysis of the encrypted files to determine the encryption algorithm used.
Why wrong: Static analysis of encrypted files is difficult without the key; it's better to identify the malware first via other IOCs.
D
Immediately disconnect the system from the network and power it off to preserve evidence.
Why wrong: While disconnecting is good, powering off may lose volatile data; you already have a memory dump, so this step is not first.

Question 15mediumdrag order

Drag and drop the steps to perform a forensic analysis of email headers to trace the origin of a spam email into the correct order.

Drag steps to the numbered slots on the right, or tap a step then tap a slot.

Steps

Order

1Step 1

2Step 2

3Step 3

4Step 4

5Step 5

Question 16mediummatching